How to KYC-screen a vendor or counterparty using free US federal data

Step-by-step guide to running know-your-customer (KYC) checks against 9 US federal datasets — OFAC, SAM, HHS-OIG, DOJ, CFPB, federal courts, Fed Reserve enforcement, NHTSA, and CISA — all free, no API key.

Steps

  1. Run the unified compliance screen

    Make a single GET request to /api/v1/screening/all?name=COMPANY_NAME. Returns a 0-100 risk_score aggregated from 9 datasets.

    You can also pass an identifier instead of a name:

  2. Interpret the risk score

    Interpret the score:

    • 0 — no hits anywhere
    • 1-30 (LOW) — minor signals like a few CFPB complaints
    • 30-60 (MEDIUM) — court cases or moderate enforcement history
    • 60-100 (HIGH) — OFAC, SAM debarment, or OIG exclusion. Do not transact.

    The summary field shows per-vertical hit counts. The details field returns the top 5 matches with canonical record-page URLs.

  3. Drill into specific hits

    For each match, follow the canonical_url to the structured-data record page. Each page carries schema.org JSON-LD, a self-canonical URL, and a separate primary-source link to the upstream agency:

  4. Pull the cross-vertical timeline

    For a richer ongoing-monitoring dossier, hit:

    Accepts ticker, CIK, UEI, LEI, DUNS, or entity_id as the key.

  5. Cite the result

    Every response includes provenance such as data_provider, generated_at, primary_source, and source-specific license or terms_of_use fields. Cite as:

    MORVS, [dataset or record], retrieved [date] from [endpoint]; primary source: [source URL]; source terms: [license or terms URL].

    Works authored by US federal employees as part of official duties are generally public domain under 17 USC §105, but non-federal, SRO, and third-party material retains its source terms. Metadata and normalization authored by MORVS (AI Analytics LLC) are CC0 1.0 only where expressly stated. Free or keyless access does not change source terms.

FAQ

What if I only have an NPI for a healthcare provider?
Pass ?npi=NPI_NUMBER. The endpoint checks the OIG exclusion table directly by NPI (the most precise match) and returns the canonical /oig-exclusion/{id} URL if the provider is excluded.
Is there a rate limit?
No API key, no rate limit beyond ordinary Cloudflare anti-abuse. Cache the response — D1 reads are sub-100ms but the canonical URLs themselves cache for 1 hour.
How fresh is the data?
Source cadence and indexed freshness vary. Check /api/v1/freshness for source-level SLA status and /coverage for recorded row counts and refresh timestamps before relying on absence.